switchroom 0.17.1 → 0.17.2

package/dist/cli/switchroom.js

@@ -28894,6 +28894,12 @@ function resolveOperatorUid() {
     if (uid > 0)
       return uid;
   }
+  const hostdUid = process.env.SWITCHROOM_HOSTD_OPERATOR_UID;
+  if (hostdUid !== undefined) {
+    const parsed = parseInt(hostdUid, 10);
+    if (Number.isFinite(parsed) && parsed > 0)
+      return parsed;
+  }
   return;
 }
 function operatorOwnedPaths(home2) {
@@ -63150,7 +63156,7 @@ var init_server4 = __esm(() => {
     },
     {
       name: "rollout",
-      description: "SAFELY roll the fleet to a pinned SEMVER version, staggered and " + "canary-gated (#2487). Unlike update_apply (a blunt all-at-once " + "recreate), this restarts agents one at a time canary-first, asserts " + "each agent's in-container `switchroom --version` matches the target, " + "and STOPS on the first mismatch \u2014 so a bad build fails on the canary " + "before touching the rest of the fleet. The durable release.pin is " + "persisted only AFTER the canary confirms (a failed canary never " + "strands a bad pin). `pin` MUST be a tagged semver (vX.Y.Z) \u2014 sha " + "pins are rejected because the version assert needs a semver to " + "compare against. The hostd/web self-refresh is DEFERRED on this path " + "(an agent-invoked rollout cannot recreate its own hostd container " + "without killing itself); run that host-side. By default downgrade pins " + "are rejected \u2014 pass `allow_downgrade: true` for the operator-approved " + "rollback path to a known-good earlier tag; all other safety rails " + "(canary order, version-assert, stop-on-mismatch) apply unchanged. " + "Admin-only at the wire layer AND deliberately NOT pre-approved \u2014 every " + "call surfaces a Telegram approval card for the operator to tap. " + "ALWAYS pass a one-line `reason` explaining why you're rolling the " + "fleet to this pin; it renders on the card's `why:` line so the " + "operator can decide in context. " + "Returns `started`; poll get_status for the structured outcome " + "(which agents rolled / where it stopped).",
+      description: "SAFELY roll the fleet to a pinned SEMVER version, staggered and " + "canary-gated (#2487). Unlike update_apply (a blunt all-at-once " + "recreate), this restarts agents one at a time canary-first, asserts " + "each agent's in-container `switchroom --version` matches the target, " + "and STOPS on the first mismatch \u2014 so a bad build fails on the canary " + "before touching the rest of the fleet. The durable release.pin is " + "persisted only AFTER the canary confirms (a failed canary never " + "strands a bad pin). `pin` MUST be a tagged semver (vX.Y.Z) \u2014 sha " + "pins are rejected because the version assert needs a semver to " + "compare against. When the target pin is NEWER than hostd's own CLI " + "(every freshly tagged release), hostd SELF-BUMPS first (#2645): its " + "container restarts on the target image (~30-60s blip on this MCP " + "socket), then the roll resumes AUTOMATICALLY under the SAME " + "request_id \u2014 do NOT re-issue the rollout during the blip; poll " + "get_status with the returned request_id once the socket is back. " + "The web refresh stays DEFERRED on this path; the terminal warnings " + "name exactly what is still on the prior version (web, host operator " + "CLI) and the host-side commands to finish. By default downgrade pins " + "are rejected \u2014 pass `allow_downgrade: true` for the operator-approved " + "rollback path to a known-good earlier tag; all other safety rails " + "(canary order, version-assert, stop-on-mismatch) apply unchanged. " + "Admin-only at the wire layer AND deliberately NOT pre-approved \u2014 every " + "call surfaces a Telegram approval card for the operator to tap. " + "ALWAYS pass a one-line `reason` explaining why you're rolling the " + "fleet to this pin; it renders on the card's `why:` line so the " + "operator can decide in context. " + "Returns `started`; poll get_status for the structured outcome " + "(which agents rolled / where it stopped).",
       inputSchema: {
         type: "object",
         required: ["pin"],
@@ -63729,8 +63735,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.17.1";
-var COMMIT_SHA = "d7162c0";
+var VERSION = "0.17.2";
+var COMMIT_SHA = "f06074f4";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {
@@ -84226,7 +84232,7 @@ function registerRolloutCommand(program3) {
     }
     if (shouldRefuseStaleCli(SWITCHROOM_VERSION, target)) {
       const cli = normalizeVersion(SWITCHROOM_VERSION);
-      const refusal = `rollout refused: the driving switchroom CLI is v${cli}, OLDER than ` + `the --pin target ${target}. An older CLI regenerates the compose file ` + `with its own (stale) generator and version stamp, which would boot ` + `agents on v${cli}, fail the canary, and leave compose downgraded ` + `below what's running. ` + (hostdCtx ? `Refresh hostd's CLI first \u2014 host-side: \`switchroom hostd install ` + `--tag ${target}\` \u2014 then re-run the roll.` : `Upgrade this CLI to >= ${target} first (e.g. \`switchroom update ` + `--pin ${target}\`, or rebuild your checkout), then re-run.`) + ` Nothing was changed.`;
+      const refusal = `rollout refused: the driving switchroom CLI is v${cli}, OLDER than ` + `the --pin target ${target}. An older CLI regenerates the compose file ` + `with its own (stale) generator and version stamp, which would boot ` + `agents on v${cli}, fail the canary, and leave compose downgraded ` + `below what's running. ` + (hostdCtx ? `Normally hostd SELF-BUMPS before this child ever spawns ` + `(#2645) \u2014 seeing this refusal means the self-bump was ` + `skipped or resumed while still stale. Refresh hostd's CLI ` + `host-side: \`switchroom hostd install --tag ${target}\` \u2014 ` + `then re-run the roll.` : `Upgrade this CLI to >= ${target} first (e.g. \`switchroom update ` + `--pin ${target}\`, or rebuild your checkout), then re-run.`) + ` Nothing was changed.`;
       process.stderr.write(refusal + `
 `);
       if (hostdCtx) {
@@ -84320,7 +84326,7 @@ function registerRolloutCommand(program3) {
 `);
     const result = executeRollout(steps, target, deps, { hostdContext: hostdCtx });
     if (hostdCtx) {
-      result.warnings.push("hostd/web refresh deferred \u2014 run host-side (`switchroom webd install` " + "/ `switchroom hostd install`). An agent-invoked rollout cannot " + "recreate its own hostd container without killing itself.");
+      result.warnings.push(`still on the PRIOR version after this roll: switchroom-web ` + `(host-side: \`switchroom webd install --tag ${target}\`) and the ` + `host operator CLI (\`sudo npm i -g switchroom@${normalizeVersion(target)}\`). ` + `hostd's compose was tag-bumped by the self-bump when one ran; a ` + `full hostd template regen (only needed when a release changes ` + `hostd's mounts/env) is \`switchroom hostd install --tag ${target}\` ` + `host-side. An agent-invoked rollout cannot recreate its own hostd ` + `container mid-roll without killing itself.`);
       process.stdout.write(encodeRolloutPhaseLine({ phase: "hostd-web-deferred", target }) + `
 `);
     }

package/dist/host-control/main.js

@@ -17257,7 +17257,9 @@ import {
   ftruncateSync,
   writeSync as writeSync2,
   fsyncSync as fsyncSync2,
-  closeSync as closeSync3
+  closeSync as closeSync3,
+  copyFileSync,
+  unlinkSync
 } from "node:fs";
 import { join as join5, dirname as dirname6, resolve as resolve6 } from "node:path";
 import { createHash as createHash5, randomUUID as randomUUID2, randomBytes } from "node:crypto";
@@ -22644,12 +22646,31 @@ var import_yaml3 = __toESM(require_dist(), 1);
 // src/cli/rollout.ts
 init_atomic();
 
+// src/config/release-resolve.ts
+function parseSemverTag(tag) {
+  if (!tag)
+    return null;
+  const m = /^v(\d+)\.(\d+)\.(\d+)$/.exec(tag.trim());
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+function compareReleaseTags(a, b) {
+  const pa = parseSemverTag(a);
+  const pb = parseSemverTag(b);
+  if (!pa || !pb)
+    return null;
+  for (let i = 0;i < 3; i++) {
+    if (pa[i] !== pb[i])
+      return pa[i] < pb[i] ? -1 : 1;
+  }
+  return 0;
+}
+
 // src/cli/resolve-version.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4 } from "node:fs";
 import { dirname as dirname4, join as join2 } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.17.1";
+var VERSION = "0.17.2";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {
@@ -22813,7 +22834,9 @@ function parseRolloutPhaseLine(line) {
     "agent-start",
     "agent-done",
     "persist-pin",
-    "hostd-web-deferred"
+    "hostd-web-deferred",
+    "self-bump",
+    "self-bump-done"
   ]);
   if (typeof o.phase !== "string" || !PHASES.has(o.phase))
     return null;
@@ -22848,6 +22871,117 @@ function parseRolloutResultLine(stdout) {
   return null;
 }
 
+// src/host-control/self-bump.ts
+var SELF_BUMP_MARKER_FILENAME = "pending-rollout.json";
+var SELF_BUMP_HELPER_CONTAINER = "switchroom-hostd-selfbump";
+var SELF_BUMP_LOG_FILENAME = "selfbump.log";
+var SELF_BUMP_MARKER_MAX_AGE_MS = 15 * 60 * 1000;
+var SEMVER_PIN_RE = /^v\d+\.\d+\.\d+$/;
+function needsSelfBump(ownVersion, pin) {
+  if (!ownVersion)
+    return false;
+  const cmp = compareReleaseTags(`v${ownVersion.trim().replace(/^v/, "")}`, `v${pin.trim().replace(/^v/, "")}`);
+  return cmp !== null && cmp < 0;
+}
+function bumpHostdComposeImageTag(yaml, pin) {
+  const re = /^(\s*image:\s*)(\S*switchroom-hostd):(\S+)\s*$/m;
+  const m = yaml.match(re);
+  if (!m)
+    return null;
+  const oldImageRef = `${m[2]}:${m[3]}`;
+  const newImageRef = `${m[2]}:${pin}`;
+  return {
+    yaml: yaml.replace(re, `$1${newImageRef}`),
+    oldImageRef,
+    newImageRef
+  };
+}
+function encodePendingRolloutMarker(m) {
+  return JSON.stringify(m, null, 2) + `
+`;
+}
+function parsePendingRolloutMarker(raw) {
+  let obj;
+  try {
+    obj = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof obj !== "object" || obj === null)
+    return null;
+  const o = obj;
+  if (o.v !== 1)
+    return null;
+  if (typeof o.request_id !== "string" || o.request_id.length === 0)
+    return null;
+  if (typeof o.pin !== "string" || !SEMVER_PIN_RE.test(o.pin))
+    return null;
+  if (typeof o.created_at !== "string" || !Number.isFinite(Date.parse(o.created_at))) {
+    return null;
+  }
+  if (typeof o.prior_hostd_version !== "string")
+    return null;
+  const caller = o.caller;
+  if (typeof caller !== "object" || caller === null)
+    return null;
+  if (caller.kind === "agent") {
+    if (typeof caller.name !== "string" || caller.name.length === 0)
+      return null;
+  } else if (caller.kind !== "operator") {
+    return null;
+  }
+  if (o.agents !== undefined) {
+    if (!Array.isArray(o.agents) || o.agents.length === 0 || !o.agents.every((a) => typeof a === "string" && /^[\w-]+$/.test(a))) {
+      return null;
+    }
+  }
+  if (o.skip_web !== undefined && typeof o.skip_web !== "boolean")
+    return null;
+  if (o.allow_downgrade !== undefined && typeof o.allow_downgrade !== "boolean") {
+    return null;
+  }
+  return {
+    v: 1,
+    request_id: o.request_id,
+    pin: o.pin,
+    ...o.agents !== undefined ? { agents: o.agents } : {},
+    ...o.skip_web !== undefined ? { skip_web: o.skip_web } : {},
+    ...o.allow_downgrade !== undefined ? { allow_downgrade: o.allow_downgrade } : {},
+    caller: caller.kind === "agent" ? { kind: "agent", name: caller.name } : { kind: "operator" },
+    created_at: o.created_at,
+    prior_hostd_version: o.prior_hostd_version
+  };
+}
+function isMarkerFresh(marker, nowMs) {
+  const created = Date.parse(marker.created_at);
+  if (!Number.isFinite(created))
+    return false;
+  return nowMs - created < SELF_BUMP_MARKER_MAX_AGE_MS;
+}
+function selfBumpHelperArgs(opts) {
+  const composePath = `${opts.hostdDirHostPath}/docker-compose.yml`;
+  const logPath = `${opts.hostdDirHostPath}/${SELF_BUMP_LOG_FILENAME}`;
+  const script = `sleep 2; ` + `echo "selfbump $(date -u) -> ${opts.targetImage}" >> "${logPath}" 2>&1; ` + `docker compose -p switchroom-hostd -f "${composePath}" pull >> "${logPath}" 2>&1 && ` + `docker compose -p switchroom-hostd -f "${composePath}" up -d >> "${logPath}" 2>&1; ` + `rc=$?; echo "selfbump done rc=$rc" >> "${logPath}" 2>&1; exit $rc`;
+  return [
+    "run",
+    "-d",
+    "--rm",
+    "--name",
+    SELF_BUMP_HELPER_CONTAINER,
+    "--label",
+    "switchroom.hostd-selfbump=true",
+    "-v",
+    "/var/run/docker.sock:/var/run/docker.sock",
+    "-v",
+    `${opts.hostdDirHostPath}:${opts.hostdDirHostPath}`,
+    "--entrypoint",
+    "/bin/sh",
+    opts.helperImage,
+    "-c",
+    script
+  ];
+}
+
 // node_modules/.bun/commander@13.1.0/node_modules/commander/esm.mjs
 var import__3 = __toESM(require_commander(), 1);
 
@@ -23503,6 +23637,10 @@ function phaseLine(s) {
       return "persisting pin";
     case "hostd-web-deferred":
       return "hostd/web refresh deferred (run host-side)";
+    case "self-bump":
+      return "hostd refreshing itself to the target (brief control blip)…";
+    case "self-bump-done":
+      return "hostd refreshed — resuming the roll";
     default:
       return "starting";
   }
@@ -23686,6 +23824,10 @@ class HostdServer {
     await chmod(hostdDir, 493).catch(() => {
       return;
     });
+    await this.resumePendingSelfBumpRollout().catch((e) => {
+      process.stderr.write(`hostd: self-bump resume failed (non-fatal): ${e.message}
+`);
+    });
     const agentNames = Object.keys(this.opts.agentUids).sort();
     if (agentNames.length === 0) {
       return;
@@ -23936,7 +24078,7 @@ class HostdServer {
           resp = this.handleApply(req, caller, started);
           break;
         case "rollout":
-          resp = this.handleRollout(req, caller, started);
+          resp = await this.handleRollout(req, caller, started);
           break;
         case "agent_start":
           resp = await this.handleAgentStart(req, started);
@@ -24208,21 +24350,34 @@ class HostdServer {
       duration_ms: Date.now() - started
     };
   }
-  handleRollout(req, caller, started) {
+  async handleRollout(req, caller, started) {
     const denied = this.checkFleetMutationLock(req.op, req.request_id, started);
     if (denied)
       return denied;
+    if (needsSelfBump(this.opts.selfVersion ?? SWITCHROOM_VERSION, req.args.pin)) {
+      return this.beginSelfBump(req, caller, started);
+    }
     const assetDenied = this.applyAssetPreflight(req.request_id, started);
     if (assetDenied)
       return assetDenied;
-    const args = ["rollout", "--pin", req.args.pin];
-    if (req.args.agents && req.args.agents.length > 0) {
-      args.push("--agents", req.args.agents.join(","));
-    }
-    if (req.args.skip_web)
-      args.push("--skip-web");
-    if (req.args.allow_downgrade)
-      args.push("--allow-downgrade");
+    const entry = this.launchRollout(req.args, req.request_id, caller, started);
+    return {
+      v: 1,
+      request_id: entry.request_id,
+      result: "started",
+      exit_code: null,
+      duration_ms: Date.now() - started
+    };
+  }
+  launchRollout(args, request_id, caller, started) {
+    const argv = ["rollout", "--pin", args.pin];
+    if (args.agents && args.agents.length > 0) {
+      argv.push("--agents", args.agents.join(","));
+    }
+    if (args.skip_web)
+      argv.push("--skip-web");
+    if (args.allow_downgrade)
+      argv.push("--allow-downgrade");
     const installCtx = readCachedInstallType(this.opts.bindRoot ?? this.opts.homeDir);
     let priorPin;
     try {
@@ -24233,16 +24388,16 @@ class HostdServer {
       }
     } catch {}
     const entry = {
-      request_id: req.request_id,
+      request_id,
       caller,
-      op: req.op,
+      op: "rollout",
       result: "started",
       exit_code: null,
       started_at: started,
       finished_at: null,
       stdout_tail: "",
       stderr_tail: "",
-      pin: req.args.pin,
+      pin: args.pin,
       install_context: {
         install_type: installCtx.install_type,
         detected_at: installCtx.detected_at
@@ -24250,19 +24405,214 @@ class HostdServer {
       ...priorPin ? { prior_pin: priorPin } : {}
     };
     this.recordStatus(entry);
+    this.fleetMutationInFlight = {
+      op: "rollout",
+      request_id,
+      started_at: started
+    };
+    this.spawnRollout(argv, entry);
+    return entry;
+  }
+  hostdDirPath() {
+    return join5(this.opts.homeDir, ".switchroom", "hostd");
+  }
+  hostdDirHostPath() {
+    const hostHome = this.opts.hostHomeDir ?? process.env.SWITCHROOM_HOST_HOME?.trim() ?? this.opts.homeDir;
+    return join5(hostHome, ".switchroom", "hostd");
+  }
+  async beginSelfBump(req, caller, started) {
+    const ownVersion = this.opts.selfVersion ?? SWITCHROOM_VERSION;
+    const composePath = join5(this.hostdDirPath(), "docker-compose.yml");
+    if (!existsSync8(composePath)) {
+      return deniedResponse(req.request_id, `rollout: hostd's CLI (v${ownVersion}) is older than the target ` + `${req.args.pin} and needs a self-bump first, but its compose file ` + `is missing at ${composePath}. Run \`switchroom hostd install ` + `--tag ${req.args.pin}\` on the host, then re-run the roll. ` + `Nothing was changed.`, Date.now() - started);
+    }
+    const before = readFileSync6(composePath, "utf8");
+    const bumped = bumpHostdComposeImageTag(before, req.args.pin);
+    if (!bumped) {
+      return deniedResponse(req.request_id, `rollout: hostd needs a self-bump to ${req.args.pin} but no ` + `switchroom-hostd image line was found in ${composePath} ` + `(hand-edited compose?). Run \`switchroom hostd install --tag ` + `${req.args.pin}\` on the host, then re-run the roll. Nothing ` + `was changed.`, Date.now() - started);
+    }
+    const probe = await this.runDocker([
+      "manifest",
+      "inspect",
+      bumped.newImageRef
+    ]);
+    if (probe.exit_code !== 0) {
+      return deniedResponse(req.request_id, `rollout: hostd needs a self-bump to ${req.args.pin} but the target ` + `image ${bumped.newImageRef} is not pullable yet (docker manifest ` + `inspect failed: ${tail(probe.stderr).trim() || "unknown error"}). ` + `The docker-images workflow may still be building — retry in a ` + `few minutes. Nothing was changed.`, Date.now() - started);
+    }
+    await this.runDocker(["rm", "-f", SELF_BUMP_HELPER_CONTAINER]).catch(() => {
+      return;
+    });
+    const ts = new Date().toISOString().replace(/[:.]/g, "-");
+    const bakPath = `${composePath}.bak-selfbump-${ts}`;
+    try {
+      const baks = readdirSync2(this.hostdDirPath()).filter((f) => f.startsWith("docker-compose.yml.bak-selfbump-")).sort();
+      for (const f of baks.slice(0, Math.max(0, baks.length - 4))) {
+        unlinkSync(join5(this.hostdDirPath(), f));
+      }
+    } catch {}
+    const markerPath = join5(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
+    const marker = {
+      v: 1,
+      request_id: req.request_id,
+      pin: req.args.pin,
+      ...req.args.agents && req.args.agents.length > 0 ? { agents: req.args.agents } : {},
+      ...req.args.skip_web ? { skip_web: true } : {},
+      ...req.args.allow_downgrade ? { allow_downgrade: true } : {},
+      caller: caller.kind === "agent" ? { kind: "agent", name: caller.name } : { kind: "operator" },
+      created_at: new Date().toISOString(),
+      prior_hostd_version: ownVersion
+    };
+    copyFileSync(composePath, bakPath);
+    writeFileSync3(composePath, bumped.yaml, "utf8");
+    writeFileSync3(markerPath, encodePendingRolloutMarker(marker), {
+      mode: 384
+    });
+    const entry = {
+      request_id: req.request_id,
+      caller,
+      op: req.op,
+      result: "started",
+      exit_code: null,
+      started_at: started,
+      finished_at: null,
+      stdout_tail: "",
+      stderr_tail: "",
+      pin: req.args.pin
+    };
+    this.recordStatus(entry);
     this.fleetMutationInFlight = {
       op: "rollout",
       request_id: req.request_id,
       started_at: started
     };
-    this.spawnRollout(args, entry);
+    this.onRolloutPhase(entry, { phase: "self-bump", target: req.args.pin });
+    const rollbackBump = () => {
+      try {
+        copyFileSync(bakPath, composePath);
+        unlinkSync(markerPath);
+      } catch (e) {
+        process.stderr.write(`hostd: self-bump rollback failed (compose/marker may need manual ` + `restore from ${bakPath}): ${e.message}
+`);
+      }
+    };
+    const helper = await this.runDocker(selfBumpHelperArgs({
+      hostdDirHostPath: this.hostdDirHostPath(),
+      helperImage: bumped.oldImageRef,
+      targetImage: bumped.newImageRef
+    })).catch((e) => ({
+      exit_code: -1,
+      stdout: "",
+      stderr: e.message
+    }));
+    if (helper.exit_code !== 0) {
+      rollbackBump();
+      entry.result = "error";
+      entry.finished_at = Date.now();
+      entry.error = `self-bump helper spawn failed: ${tail(helper.stderr).trim()}`;
+      this.fleetMutationInFlight = null;
+      this.writeTerminalAudit(entry);
+      return {
+        v: 1,
+        request_id: req.request_id,
+        result: "error",
+        exit_code: null,
+        duration_ms: Date.now() - started,
+        error: `rollout: could not spawn the hostd self-bump helper container ` + `(${tail(helper.stderr).trim() || "unknown error"}). The compose ` + `bump was rolled back — nothing is changed. Fallback: ` + `\`switchroom hostd install --tag ${req.args.pin}\` on the host, ` + `then re-run the roll.`
+      };
+    }
+    this.runDocker(["wait", SELF_BUMP_HELPER_CONTAINER]).then((w) => {
+      const code = Number.parseInt(w.stdout.trim(), 10);
+      if (w.exit_code !== 0 || !Number.isFinite(code)) {
+        process.stderr.write(`hostd: self-bump watcher could not read the helper's exit ` + `code (docker wait rc=${w.exit_code}): ${tail(w.stderr).trim()}
+`);
+        return;
+      }
+      if (code === 0)
+        return;
+      rollbackBump();
+      entry.result = "error";
+      entry.finished_at = Date.now();
+      entry.error = `self-bump helper failed (container exit ${Number.isFinite(code) ? code : "unknown"}). ` + `See ${join5(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)} on the host. ` + `Compose bump rolled back. Fallback: \`switchroom hostd install ` + `--tag ${req.args.pin}\` host-side, then re-run the roll.`;
+      if (this.fleetMutationInFlight && this.fleetMutationInFlight.request_id === entry.request_id) {
+        this.fleetMutationInFlight = null;
+      }
+      this.writeTerminalAudit(entry);
+      this.pushRolloutTerminal(entry);
+    }).catch(() => {
+      return;
+    });
     return {
       v: 1,
       request_id: req.request_id,
       result: "started",
       exit_code: null,
-      duration_ms: Date.now() - started
+      duration_ms: Date.now() - started,
+      payload: JSON.stringify({
+        phase: "self-bump",
+        pin: req.args.pin,
+        rolled: [],
+        note: `hostd's CLI (v${ownVersion}) is older than ${req.args.pin}, so ` + `hostd is refreshing itself first: its container restarts on the ` + `target image (~30-60s blip on this socket), then the roll resumes ` + `AUTOMATICALLY under this same request_id. Poll get_status with ` + `this request_id after the blip; do NOT re-issue the rollout.`
+      })
+    };
+  }
+  async resumePendingSelfBumpRollout() {
+    const markerPath = join5(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
+    if (!existsSync8(markerPath))
+      return;
+    let raw;
+    try {
+      raw = readFileSync6(markerPath, "utf8");
+    } finally {
+      try {
+        unlinkSync(markerPath);
+      } catch {}
+    }
+    const marker = parsePendingRolloutMarker(raw);
+    if (!marker) {
+      process.stderr.write(`hostd: pending-rollout marker at ${markerPath} was malformed — ` + `dropped without resuming. The originating roll will surface via ` + `the orphan sweep.
+`);
+      return;
+    }
+    const caller = marker.caller.kind === "agent" ? { kind: "agent", name: marker.caller.name } : { kind: "operator" };
+    const failResume = async (why) => {
+      const entry2 = {
+        request_id: marker.request_id,
+        caller,
+        op: "rollout",
+        result: "error",
+        exit_code: null,
+        started_at: Date.parse(marker.created_at) || Date.now(),
+        finished_at: Date.now(),
+        stdout_tail: "",
+        stderr_tail: "",
+        pin: marker.pin,
+        failed_step: "self-bump",
+        error: why
+      };
+      this.recordStatus(entry2);
+      process.stderr.write(`hostd: self-bump resume failed: ${why}
+`);
+      await this.writeTerminalAudit(entry2);
+      this.pushRolloutTerminal(entry2);
     };
+    const ownVersion = this.opts.selfVersion ?? SWITCHROOM_VERSION;
+    if (!isMarkerFresh(marker, Date.now())) {
+      await failResume(`pending-rollout marker for ${marker.pin} (request_id ` + `${marker.request_id}) was older than the resume cutoff — the ` + `self-bump helper likely stalled. hostd is now on v${ownVersion}. ` + `Re-issue the rollout to try again.`);
+      return;
+    }
+    if (needsSelfBump(ownVersion, marker.pin)) {
+      await failResume(`hostd is still on v${ownVersion} after the self-bump to ` + `${marker.pin} (helper failed? see ` + `${join5(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)}). ` + `Fallback: \`switchroom hostd install --tag ${marker.pin}\` ` + `host-side, then re-issue the rollout.`);
+      return;
+    }
+    process.stderr.write(`hostd: resuming rollout ${marker.request_id} → ${marker.pin} after ` + `self-bump (v${marker.prior_hostd_version} → v${ownVersion})
+`);
+    const entry = this.launchRollout({
+      pin: marker.pin,
+      ...marker.agents ? { agents: marker.agents } : {},
+      ...marker.skip_web ? { skip_web: true } : {},
+      ...marker.allow_downgrade ? { allow_downgrade: true } : {}
+    }, marker.request_id, caller, Date.now());
+    this.onRolloutPhase(entry, { phase: "self-bump-done", target: marker.pin });
   }
   async handleAgentStart(req, started) {
     const res = await this.runSwitchroom(["agent", "start", req.args.name]);
@@ -25519,6 +25869,9 @@ class LogTailRolloutNarrator {
   }
   static seqFor(phase) {
     switch (phase.phase) {
+      case "self-bump":
+      case "self-bump-done":
+        return 0;
       case "apply":
         return 0;
       case "canary-start":

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.17.1",
+  "version": "0.17.2",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {